tools: Let scan_for_updates.py read a local PackageInfo.g

[fingolfin]

Allow passing a path to a local package instead of a package name:

./tools/scan_for_updates.py path/to/my_gap_package

The path may be either the directory holding the PackageInfo.g, or that
file itself. Its metadata is then read from disk rather than downloaded
from the PackageInfoURL, so that a package author can see what the
distribution will make of an update before publishing it.

Arguments naming a package of the distribution keep their meaning. That
needs a little care, because the packages/NAME and
packages/NAME/meta.json forms that normalize_pkg_name accepts are
paths on disk as well: an argument is therefore only treated as a local
package once it turns out not to name a package of the distribution.

Names and paths cannot be mixed. A path that does not exist, and a
directory without a PackageInfo.g, are reported as such instead of
being taken for a package name -- the latter only for arguments with a
directory part, so that a mistyped package name still produces the usual
error about the missing meta.json.

Note that only the metadata comes from disk. The source archive is still
fetched from ArchiveURL, so until it is published scan_for_updates.py
warns and records FAIL as its checksum, and validate_package.py fails
outright because it cannot download the archive it is supposed to check.
The README section that used to point at this issue as a known limitation
now documents the new usage, including that caveat.

Fixes #1024

AI disclosure

Claude Code (Claude Opus 5) wrote the change, the tests, and this
description, and is recorded as a co-author on the commit.